Week 22, 2024
27 May to 2 June 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 532CVEs publishedin the whole week
- 69CriticalCVSS 9.0 and above
- 190HighCVSS 7.0 to 8.9
- 4Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-24919
Information disclosure
checkpoint · Check Point Quantum Gateway, Spark Gateway and CloudGuard Network
ExploitedHigh8.6 - CVE-2024-1086
Use-after-free in Linux kernel's netfilter: nf_tables component
Linux · Kernel
ExploitedHigh7.8 - CVE-2024-4978
Malicious Code in Justice AV Solutions (JAVS) Viewer
Justice AV Solutions · Viewer
ExploitedHigh8.7 - CVE-2024-5274
Type Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.…
Google · Chrome
ExploitedHigh8.3
Most severe new CVEsBy CVSS score
- CVE-2024-3820
wpDataTables - Tables & Table Charts (Premium) <= 6.3.1 - Unauthenticated SQL Injection
WPDataTables · wpDataTables (Premium)
Critical10.0 - CVE-2024-5407
Code Injection vulnerability in RhinOS from SaltOS
SaltOS · RhinOS
Critical10.0 - CVE-2024-36388
MileSight DeviceHub - CWE-305 Missing Authentication for Critical Function
MileSight · DeviceHub
Critical10.0 - CVE-2024-1100
SQLi in Vadi Corporate Information Systems' DIGIKENT GIS
Vadi Corporate Information Systems · DIGIKENT GIS
Critical10.0 - CVE-2024-0851
SQLi in Grup Arge Energy and Control Systems's Smartpower
Grup Arge Energy and Control Systems · Smartpower
Critical10.0 - CVE-2024-3200
wpForo Forum <= 2.3.3 - Authenticated (Contributor+) SQL Injection
tomdever · wpForo Forum
Critical9.9 - CVE-2024-35344
Certain Anpviz products contain a hardcoded cryptographic key stored in the firmware of the device. This affects IPC-D250, IPC-D260, IPC-B850, IPC-D850,…
Product not named
Critical9.9 - CVE-2024-23692
Rejetto HTTP File Server 2.3m Unauthenticated RCE
Rejetto · HTTP File Server
ExploitedCritical9.8 - CVE-2024-4358
Registration Authentication Bypass Vulnerability
Progress Software Corporation · Telerik Report Server
ExploitedCritical9.8 - CVE-2024-34854
F-logic DataCube3 v1.0 is vulnerable to File Upload via `/admin/transceiver_schedule.php.`
Product not named
Critical9.8